DPDP compliance requirements pyramid

In March 2025, the DPDP (Data Protection and Privacy) Act enforcement began in earnest. By June 2026, the first wave of fines hit digital marketing agencies and e-commerce businesses across India. The pattern was consistent: businesses that had not mapped their lead generation, customer data, and automated workflows to DPDP requirements faced penalties ranging from ₹500 to ₹10,000 per violation.

The worst part? Most violations were entirely preventable. The agencies that got fined had been handling customer data the same way for years — no explicit consent, no data flow documentation, no vendor agreements.

This guide explains what DPDP 2025 actually requires for digital marketing in India, which data practices are now legally required, and what you need to do right now to stay compliant. This is not legal advice — but it is what your lawyers would tell you to implement.

What is DPDP 2025, Really?

The Digital Personal Data Protection Act, 2023 (DPDP Act) came into force on August 16, 2025. It is India's first comprehensive personal data protection law. It applies to any business that collects, stores, or processes personal data of individuals in India — which, if you run digital marketing campaigns, capture leads, or send emails, means you.

Unlike earlier data protection frameworks that were scattered across IT Act and RBI guidelines, DPDP is a single, enforceable law with specific penalties. The law is enforced by the Data Protection Board (DPB), a new regulatory authority with the power to levy fines and order business shutdowns.

What Data Does DPDP Cover?

DPDP applies to "personal data" — any information that can identify a living individual. For digital marketing, this includes:

If you collect, store, or process any of this in your marketing operations, you are a "data fiduciary" under DPDP — which means you have specific legal obligations.

The Core DPDP Requirements — Mapped to Digital Marketing

Step 1 — Map Your Data Flows

Before you can become compliant, you need to know exactly where personal data enters your system, where it sits, and where it goes.

Create a simple data map that documents:

• Data sources:

  Where do you collect personal data? Website forms, WhatsApp, Google Ads lead forms, JustDial, referral networks, events, phone calls?

• Processing tools:

  What systems does data flow through? CRM (Zoho, HubSpot), email marketing (MailChimp, Brevo), analytics (Google Analytics), ads platforms (Meta Ads Manager, Google Ads)?

• Data processors:

  Who can access the data beyond your team? Third-party integrators, marketing agencies, consultants, freelance developers?

• Data retention:

  How long do you keep data? When and how is it deleted? Are there backups or archives that also need deletion?

• Consent records:

  Can you prove that each contact gave explicit consent? Do you have timestamps and the exact consent text they agreed to?

Most agencies discover they have serious gaps in this map — data stored in old email lists with no consent record, CRM entries without timestamps, WhatsApp numbers collected without explicit permission.

Step 2 — Implement Explicit Consent

DPDP requires "explicit consent" — not pre-ticked boxes, not inferred agreement, but clear, affirmative consent that is recorded and timestamped.

For digital marketing, this means:

Step 3 — Update Your Privacy Notice and Vendor Agreements

Every data processor you work with — from your CRM to your email platform to your analytics tool — must have a written agreement stating they process data on your instructions and maintain DPDP compliance.

Your privacy notice (the page or email footer text) must explicitly state:

• What data you collect

  Name, email, phone, location — be specific

• Why you collect it

  "To send you marketing messages" or "to understand your interests" — be honest

• How long you keep it

  Example: "For 2 years after last contact, then deleted"

• Who can access it

  List the vendors (Google, Zoho, Mailchimp, etc.)

• Their data rights

  Right to access, correct, delete, withdraw consent

• How to exercise rights

  Exact email address or phone number to request deletion

Step 4 — Set Up Data Deletion and Fulfillment Process

DPDP requires you to delete data within 30 days of a request. This is harder than most agencies expect because data is often scattered across multiple systems.

Create a documented process:

1. Receive deletion request Someone emails or messages asking to delete their data. Log the request with date and requestor contact info.
2. Identify all copies of their data Search your CRM, email lists, analytics platforms, ads audiences, backups, any cloud storage. Make a checklist of every place that person's data exists.
3. Delete from primary systems Delete from CRM, email platform, lead database. Keep deletion logs showing timestamp and reason.
4. Notify vendors Email your data processors (Google, Zoho, email platform) asking them to delete the data on their systems. Get confirmation.
5. Verify deletion Check the systems to confirm data is actually gone. Some platforms hide data but don't fully delete.
6. Confirm to requestor Send email within 30 days confirming deletion is complete. Keep this email on record.

What To Do Right Now — Compliance Checklist

• Audit your lead data

  Count your total contacts. How many have documented, timestamped consent? Assume anything older than 6 months lacks proper documentation.

• Update your website privacy notice

  Add explicit mention of DPDP. State what data you collect, why, how long you keep it, and how people can request deletion.

• Add consent checkboxes to all forms

  Website forms, landing pages, lead capture forms. Make them non-pre-ticked and save the timestamp.

• Gather vendor agreements

  Contact your CRM, email platform, ads manager, analytics platform. Request their Data Processing Agreement (DPA) which confirms DPDP compliance.

• Re-consent your existing lists

  Send email to all current contacts asking them to confirm they want to stay on your list. Track responses.

• Document your data process

  Create a simple diagram or list showing: where data comes in → where it is stored → how long it stays → how it is deleted.

• Set up a deletion request handler

  Designate someone to handle deletion requests. Commit to 30-day fulfillment. Create a template response email.

Common DPDP Mistakes That Cost Money

At AdsVerse, we have built DPDP-compliant lead generation and automation systems for agencies in Indore and across India. If you are still using outdated consent and data handling practices, now is the time to fix it — before the Data Protection Board finds you.